This re-arranges the alloc exec Run implementation to have validation
hoisted as high as possible.

This PR moves creating the API client into the returned predict
function. The creation of the client causes a lookup of all the system
certificates and doing that for each command on mac was extremely slow.

@chelseakomlo heads up on this change